# CVE-2026-89593

## Summary

- **CVE ID:** CVE-2026-89593
- **Severity:** HIGH
- **CVSS Score:** 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

hugetlb: only adjust reservation during unmapping if mapcount is 0

Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations.  In
the case of folio mapped in both a parent and a child, if the parent
unmaps the range first, the reservation adjustment will result in an
underflow of the reserved count.  Once the child unmaps the range, the
count is restored.  Change __unmap_hugepage_range() to check the mapcount
before adjusting the reservation.

## Affected Products

- Linux — Linux (df7a6d1f64056aec572162c5d35ed9ff86ece6f3)
- Linux — Linux (6.9)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (6.12.110)

## References

- [CNA](https://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d)
- [CNA](https://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea)
- [CNA](https://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b)
- [CNA](https://git.kernel.org/stable/c/b0b1b9ca80b795ed2223e76dd787db7067121fb9)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.13%
- **EPSS Percentile:** 2.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._